[red] Revalidate preserved public firmware

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>
(cherry picked from commit 693e623f37be92e36ce99cdc6a892f7cff602607)

Author: yyods

tests/firmware_tests/host/test_release_bundle.py

@@ -2496,6 +2496,33 @@ def test_complete_passed_hil_bundle_passes_public_validation(self):
         finally:
             license_fixture.close()
 
+    def test_previously_activated_public_bundle_revalidates_without_build_evidence(
+        self,
+    ):
+        bundle = self.fixture.make_bundle(public=True)
+        result = RELEASE.validate_bundle(
+            bundle,
+            previously_activated_public=True,
+            qualification_repo_root=self.fixture.repo,
+        )
+        self.assertEqual(result["identity"]["version"], "0.4.1")
+
+        with self.assertRaises(RELEASE.ReleaseError):
+            RELEASE.validate_bundle(
+                bundle,
+                public=True,
+                previously_activated_public=True,
+                qualification_repo_root=self.fixture.repo,
+            )
+
+        pending = self.fixture.make_bundle(public=False)
+        with self.assertRaises(RELEASE.ReleaseError):
+            RELEASE.validate_bundle(
+                pending,
+                previously_activated_public=True,
+                qualification_repo_root=self.fixture.repo,
+            )
+
     def test_corrupt_truncated_missing_and_swapped_parts_fail_closed(self):
         mutations = {
             "corrupt": lambda bundle: (

tools/web/src/test/firmware-staging.test.ts

@@ -638,6 +638,64 @@ describe("external firmware bundle staging", () => {
     ).rejects.toThrow();
   });
 
+  it("revalidates only an exact previously activated public staged release", async () => {
+    const fixture = createFirmwareReleaseFixture({
+      deployment: "public",
+      accessControlled: false,
+      hilStatus: "passed",
+    });
+    const bundleDirectory = await temporaryDirectory(
+      "preserved-public-source",
+    );
+    const stagedRoot = await temporaryDirectory("preserved-public-staged");
+    await writeExternalBundle(bundleDirectory, fixture);
+    const descriptor = await stageFixture({
+      accessControlled: false,
+      bundleDirectory,
+      deployment: "public",
+      outputDirectory: stagedRoot,
+    });
+
+    const stagingModule =
+      (await import("../../scripts/stage-firmware-release")) as unknown as {
+        validatePreservedPublicFirmwareRelease?: (
+          stagedRoot: string,
+          options: {
+            releaseValidator: typeof acceptSyntheticFixture;
+          },
+        ) => Promise<typeof descriptor>;
+      };
+    const validatePreserved =
+      stagingModule.validatePreservedPublicFirmwareRelease;
+    expect(validatePreserved).toBeTypeOf("function");
+    if (!validatePreserved) {
+      return;
+    }
+
+    await expect(
+      validatePreserved(stagedRoot, {
+        releaseValidator: acceptSyntheticFixture,
+      }),
+    ).resolves.toEqual(descriptor);
+
+    const selectionPath = join(
+      stagedRoot,
+      ".pyble-firmware-release-selection.json",
+    );
+    const selection = JSON.parse(await readFile(selectionPath, "utf8")) as {
+      deployment: string;
+      hilStatus: string;
+    };
+    selection.deployment = "candidate";
+    selection.hilStatus = "pending";
+    await writeFile(selectionPath, `${JSON.stringify(selection, null, 2)}\n`);
+    await expect(
+      validatePreserved(stagedRoot, {
+        releaseValidator: acceptSyntheticFixture,
+      }),
+    ).rejects.toThrow(/previously activated|public|passed/i);
+  });
+
   it("requires explicit published-GitHub evidence with byte equality before public activation", async () => {
     const fixture = createFirmwareReleaseFixture();
     const bundleDirectory = await temporaryDirectory(

tools/web/src/test/vps-self-hosted-release-contract.test.ts

@@ -25,7 +25,7 @@ describe("self-hosted firmware activation", () => {
       /\b(?:ssh|rsync)\b[\s\S]{0,2400}\.pyble-firmware-release-selection\.json/,
     );
     const preservedValidation = script.indexOf(
-      "--verify-staged",
+      "--verify-preserved-staged",
       authenticatedRetrieval,
     );